What we know about you, and why.

The short version: we collect only what we need to deliver the service. We never sell your data. We never use your memory content to train models. You can export everything within seven days of asking, and we delete everything within fourteen days of you leaving.

The rest of this page is the long version. If you only read the short version, you have the substance.

1. Who we are

Jonny Memory is operated by Avihay Zanetti, a sole-trader founder based in Israel, trading through Jonnyweb.co.il. When this policy says "we," "us," or "our," it means me. There is no holding company, no parent group, no separate data team. I am the data controller and the data processor for the service. My contact is zanetti@avihayzanetti.ai.

For the purposes of GDPR, I am the controller of personal data submitted through this site and the processor of memory content stored on the platform. For the purposes of the CCPA, I am the business that determines the purposes and means of processing.

2. What we collect

Four categories, listed in plain language.

2.1 Application and onboarding data

When you apply through the form on this site, we receive your name, email, company, role, optional LinkedIn URL, the AIs you use, your daily usage range, a short description of the problem you are solving, and whether you are an existing AvihayZanetti.ai client. We also capture standard request metadata (user agent, referrer, viewport size, timestamp) for debugging and rate limiting.

2.2 Account and billing data

If you become a client, we hold the contact information on your invoice (legal name, billing address, email, tax identifier where applicable). Billing for US clients runs through Green Invoice, which holds payment records on our behalf. We do not store credit card numbers ourselves.

2.3 Memory content

This is the substance of the service. Memory content is whatever you ask us to seed during onboarding, plus whatever your AI surfaces write to your memory layer while you work. It can include names of people you work with, project context, calendar references, decisions, preferences, and any other context you choose to entrust to the system.

You decide what enters the memory. You can review and edit it at any time. We never use your memory content to train models, generate aggregated insights, or for any purpose other than running your service.

2.4 Operational logs

Per-client audit logs of every read and write against your memory layer (commitment 05 on the Trust page). Server logs from the infrastructure layer for security and uptime monitoring. These logs do not contain memory content, only metadata about access events.

3. Why we collect it

Six purposes, no others.

1. To evaluate your application and decide whether to admit you to the Pre-Release cohort.
2. To deliver the service you contracted: storing your memories, serving them to your AI surfaces, and tuning the layer quarterly.
3. To bill you accurately and meet our tax and accounting obligations under Israeli and applicable foreign law.
4. To support you, respond to questions, and investigate incidents.
5. To monitor the platform for security, abuse, and reliability.
6. To comply with legal obligations (subpoena, court order, regulatory request), where we cannot lawfully refuse.

We do not run advertising, we do not profile you for marketing purposes, and we do not enrich your data against third-party databases.

4. Where your data lives

Memory content lives on enterprise-grade infrastructure with SOC 2 Type 1 and HIPAA compliance at the infrastructure layer. Encryption in transit (TLS 1.3) and encryption at rest are standard on every tier. Family-Office clients can bring their own encryption keys. Full details, including the eight commitments on data handling, are on the Trust page.

Application form data flows through our n8n automation layer at x.jonny.cloud, hosted under the same infrastructure family, before landing in our CRM (Attio).

Billing data lives in Green Invoice for US clients and equivalent Israeli accounting systems for tax filings.

5. Who has access

By default, only I do. There is no support team. No analytics intern. No outsourced operations partner.

We use third-party infrastructure subprocessors (the cloud platform that hosts your memory, the memory engine vendor underneath, the billing platforms, the CRM, the analytics tool). The list of subprocessors is disclosed to you during onboarding under NDA and updated quarterly. Material subprocessor changes are communicated in writing 30 days in advance, per commitment 08 of the Trust page.

We disclose data to third parties only in three cases:

• To subprocessors, strictly for the purposes of delivering your service, under contracts that bind them to confidentiality and security standards no weaker than ours.
• To comply with a binding legal order. Where lawful, we will notify you before responding so you have an opportunity to object.
• To a successor entity in the event of a sale, merger, or change of control. In that case, the successor inherits this policy in full, and you have the right to terminate and export your data on the standard 7 and 14-day timelines.

6. Your rights

You have the following rights regardless of where you live. Some are stronger in specific jurisdictions; the floor below applies to everyone.

• Access. Ask what we hold about you. We respond within 30 days.
• Export. Receive your memory content in standard formats (JSON, CSV) within 7 days of request.
• Correction. Ask us to correct anything inaccurate. We do it on the same day, or explain why we cannot.
• Deletion. Ask us to delete your data. We complete deletion within 14 days of termination of service, per commitment 07 on the Trust page. Backups roll off within an additional 7 days.
• Restriction and objection. Ask us to stop processing for a specific purpose. Where we can, we do.
• Portability. Receive your data in machine-readable formats that you can move elsewhere.
• Complaint. EU residents can lodge a complaint with their local supervisory authority. California residents can contact the California Attorney General's office.

To exercise any of these rights, email zanetti@avihayzanetti.ai. I respond personally within 72 hours.

7. GDPR posture (EU and UK residents)

If you are in the European Union, European Economic Area, or United Kingdom, the GDPR (or UK GDPR) applies to your personal data.

Our lawful bases for processing are: (a) performance of a contract, when you are a client and we process your data to deliver the service, (b) legitimate interest, when we process application data to evaluate fit before a contract exists, and (c) legal obligation, when we process billing data to meet tax requirements.

Memory content stored on the platform may include personal data about people you work with. You are the controller of that data; we are your processor. A data processing addendum is available on request and is recommended for any client whose work involves regular processing of EU residents' personal data.

Cross-border transfer: data may be processed outside the EU/EEA/UK in jurisdictions where our infrastructure provider operates. Transfers rely on the standard contractual clauses (or successor mechanisms) where required.

8. California privacy rights (CCPA)

If you are a California resident, the California Consumer Privacy Act gives you specific rights. In summary:

• The right to know what categories of personal information we collect, the sources, the purposes, and the categories of third parties with whom we share it. The answer is in Sections 2 through 5 above.
• The right to request deletion. Same timeline as everyone else: 14 days from termination.
• The right to opt out of the sale of personal information. We do not sell personal information, period. There is nothing to opt out of.
• The right to non-discrimination for exercising your rights. Exercising any right under this policy will never result in a price change, service degradation, or any other adverse treatment.

In the past 12 months we have not sold or shared (in the CCPA sense) any personal information.

9. Cookies and analytics

Our cookie posture is deliberately minimal.

• Essential cookies. A small number of cookies set by the application form for session management and abuse prevention. These are not used for tracking.
• Analytics. We are evaluating Microsoft Clarity (anonymized session recordings) and Plausible (aggregate page-view counts) and will install one or both during Pre-Release. Neither tool will be used for advertising. We will update this policy when an analytics tool is installed, and surface a consent prompt where one is required.
• No third-party advertising trackers. No Google Ads tags, no Facebook Pixel, no LinkedIn Insight Tag, no retargeting pixels. We do not buy traffic, so we do not need to measure ad attribution.

If you set your browser to refuse cookies, the site continues to work. The application form may behave slightly differently if cookies are blocked entirely.

10. How long we keep things

• Memory content. Retained for as long as you are a client. Deleted within 14 days of termination. Backups roll off within an additional 7 days.
• Application data (declined or unaccepted). Retained for 12 months in case you reapply, then deleted automatically.
• Billing records. Retained for 7 years to meet Israeli accounting requirements. This is a legal obligation we cannot shorten.
• Operational logs. Retained on a rolling 90-day window. Security-relevant events may be retained for up to 12 months.

11. Security

Our security posture is documented in detail on the Trust page. Highlights: TLS 1.3 in transit, encryption at rest, per-client API keys, per-client audit logs, daily backups, written incident disclosure within 72 hours of confirmed impact.

No system is impregnable. If something happens, you hear about it from us, in writing, within 72 hours, with full scope and remediation steps.

12. Children

This service is built for executives and family offices. It is not directed at, marketed to, or intended for anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has submitted personal information through this site, email zanetti@avihayzanetti.ai and we will delete it.

13. Changes to this policy

If we change this policy materially, we email every active client 30 days before the change takes effect, and we update the "last updated" date at the top of this page. Non-material changes (typos, formatting, clarifications that do not affect your rights or our obligations) take effect on publication.

If you object to a material change, you can terminate the service on the standard 30-day notice, with full data export and deletion on the standard timelines.

14. How to reach me

One person, one inbox.

Avihay Zanetti
Email: zanetti@avihayzanetti.ai
Based in Israel. Onboarding scheduled in your time zone.

For matters that require a postal address (regulatory complaints, formal data-subject requests), email me first and I will provide the current mailing address. I will not publish a home or office address on a public web page.